Technical Overview Of HP 3PAR File Persona Software Suite .

Technical white paper Technical overview of HP 3PAR File Persona Software SuiteActive DirectoryActive Directory is a directory service primarily used in Windows environments, where Kerberos, NTLMv2, and NTLM areprimary types of authentications. HP 3PAR File Persona Software Suite supports the user credential authentication usingKerberos, NTLMv2, or NTLM authentication in Active Directory based on the authentication stack order defined within FilePersona Software Suite. Active Directory performs name lookups and authentications for user accounts and groups andall user name lookups are stored in Active Directory name cache on the File Persona node. This cache is referenced orpopulated for every user name request and will be cleared when the File Persona is restarted.The File Persona node joins the Windows Active Directory domain where it creates the computer account for the FilePersona node. The computer name created in the AD domain is in the format of HP 3PAR StoreServ system name plusthe node number (e.g., deptserver-0.sales.hp.com 1). Use showfs -ad command at the HP 3PAR OS CLI to check if thenode has joined the Active Directory domain properly.Note Networking node IP addresses, gateway, and Domain Name System (DNS) should be configured on the File Persona nodebefore attempting to associate to LDAP or Active Directory. NTP should be configured for HP 3PAR StoreServ system such that the array and the domain controller are relatively insync before attempting an Active Directory-join, or the join may fail.Lightweight Directory Access Protocol (LDAP)LDAP is most commonly used in Linux/UNIX environments, where customers have users that connect to SMB or NFS shares onHP 3PAR StoreServ system running File Persona Software Suite. The LDAP provider uses ldapsearch requests to lookup usersand groups by name or security identifier (SID). SIDs are formulated based on an SID prefix and user ID (UID)/group ID (GID)when the POSIX schema template is configured. It also provides NTLM or NTLMv2 authentication by matching a user-suppliedpassword with a Windows-encrypted password stored in LDAP. The LDAP schema attribute it uses, depends on the schematemplate used. The File Persona SMB server can be configured to use either Samba or POSIX schema, but only one schema at atime. Use showfs -ldap command at the CLI to check the status of LDAP authentication.The LDAP connection for File Persona Software Suite can be using three categories: Simple connection—The authentication is done through plain text. Secure Sockets Layer (SSL)—The authentication is done through NTLM and uses the LDAP server’s fully qualifieddomain name (FQDN) name to connect. The communication will be established on port 636 by default. Transport Layer Security (TLS)—The authentication is done through NTLM and uses the LDAP server FQDN nameto connect. The communication will be established on port 389 by default.Local authenticationLocal authentication will often be used in smaller Windows or Linux/UNIX environments. Each node has a copy of thelocal user database. All changes to the local accounts database are replicated to all File Persona nodes in a system.Local users are authenticated using NTLMv2 authentication by default. The password is stored in encrypted form inthe local user database. UIDs and GIDs are assigned automatically if not specified during their creation. The StorageAdministrator should make sure that IDs are unique across the name services.16Windows 2000 and above DNS domain name support up to 24 characters in the hostname. Make sure to follow Microsoft guidelines for the hostnamecharacter length.

Technical white paper Technical overview of HP 3PAR File Persona Software SuiteAuthentication stack orderThe authentication stack order can be configured from the SSMC after enabling Advanced options in the Configure FilePersona menu. The Local Users & Groups must be included in the Provider Order, while LDAP and Active Directory areoptional. Active Directory and Local Users & Groups are the default stacking orders (see figure 3), and as a best practice,there should not be a value in the stacking order that is not configured. To show the configured stacking order on theCLI use showfs –auth. Note that the stacking order is configured separately from the authentication methods, and if amethod is not in the stack, users will not be able to authenticate using that method.Figure 3. Configuring the authentication stack orderNoteThe authentication and authorization method used for HP 3PAR File Persona Software Suite is separate from the securitymethod used for management of the HP 3PAR StoreServ array (Management Console and CLI). For instance, managementarray access can be using local authentication and authorization method (on the HP 3PAR StoreServ nodes), while HP 3PARFile Persona is using Active Directory for authentication and authorization.Authorization and permissionsAuthorization is a process used to verify what effective permissions a user (or group) has on files or folders. Authorizationis performed by comparing user account or member names of a group with the permissions on file storage resources suchas files or directories. Only authorized users (or groups) are allowed to access any file or folder, while the rest are deniedaccess. For shared folder access, the user has to go through the share permissions first to check if the user is authorizedto access that share. An ACL is a list of access control entries (ACEs). Each ACE in an ACL identifies a trustee and specifiesthe access rights allowed, denied, or audited for that trustee. SMB users are granted access based on the advanced accessrights allowed through NTFS ACLs permissions set on files and directories. NFS users are granted access based on thePOSIX or NFSv4 ACLs set on file or directories. The user’s name or UID and all group memberships/GIDs are evaluatedin determining access to files and directories. The most restrictive user rights are honored when granting access to filesand folders.7

Technical white paper Technical overview of HP 3PAR File Persona Software SuiteConverged ACLHP 3PAR File Persona Software Suite uses the advanced HP Adaptive File System that is designed for storing the convergedACLs on the disk in the NFSv4.1 ACL format for all files and directories and converts the ACLs to each protocol specific ACLfor SMB, NFS, or HTTP clients, as described in table 1. The Adaptive File System also performs the name resolution for theusername from the protocol specific username format to user principal name (UPN) format to store on the disk.Table 1. Converged ACLsConverged ACL stackSMBNFSv3NFSv4Object Access API over HTTPACLs enforcerSMB serverFPG (file system)FPG (file system)FPG (file system)ACLs enforced by File PersonaNTFS ACLsPOSIX ACLsPOSIX ACLsPOSIX ACLsOn-disk ACLs storedNFSv4.1 ACLsNFSv4.1 ACLsNFSv4.1 ACLsNFSv4.1 ACLsName resolutionDomain\username user@domainnameUID/GID user@domainname user@domainname user@domainnameDomain\username user@domainnameNoteHP 3PAR File Persona Software Suite supports file locking within a protocol but not across protocols, so accessing thesame file simultaneously from different file protocols is not supported. This restriction does not preclude the access of thedirectory or files by any file protocol at different times e.g., all locks held by SMB clients are honored by other SMB clients.Access-based Enumeration (ABE)HP 3PAR File Persona Software Suite supports Access-based Enumeration, which is a very useful feature in the homedirectories consolidation scenario. Access-based Enumeration is a Microsoft Windows feature which when applied on anSMB share, allows users to list only the files and folders to which they have access when browsing content on the file share.This avoids user confusion that can be caused when users connect to a file share and encounter a large number of files andfolders that they cannot access. This feature allows administrators to control the display of files and folders according to auser’s access rights. Therefore, when applied on a shared folder that contains many home directories, users who access theshared folder can see only their personal home directories; other users’ folders are hidden from view. This can also be usedon group shares with common set of the files or application data, accessed by a group of users.In addition to protecting sensitive information at your workplace, ABE enables administrators to simplify the display of largedirectory structures for the benefit of users who do not need access to the full range of content. End users see only the filesand folders that they are responsible for, rather than looking through a busy folder structure with hundreds of users foldersin it. . Administrators can be more productive because they don’t have to help less-skilled users navigate through denseshared folders. Enabling ABE in File Persona is done by specifying the –abe true option when creating the File Sharecreatefs smb –abe true vfs sharename . The SSMC can also be used to enable this when creating ormodifying the File Share, (see figure 4 [enable the Advanced options]).Figure 4. Enable ABE on file share8

Technical white paper Technical overview of HP 3PAR File Persona Software SuiteProtocol supportSMB protocolThe SMB protocol is the most widely used protocol for home directory access and brings a robust feature set forenterprise file sharing. File sharing protocols provide central management of data that uses client/server method,reduces administrative overhead, and provides granular access control to the files.The SMB protocol is the default protocol used by the Windows clients, but there are also Mac Linux, and Samba clients, whichuse the SMB protocol to connect to an SMB file server. It brings a variety of security, performance, resiliency, and efficiencyfeatures that help customers to offer home directories, group/department shares, and corporate shares to their clients.The SMB File Share can be created using createfshare smb [options arg ] vfs sharename instructing the File Share to use the SMB protocol.Figure 5. Creating SMB file shareHP 3PAR File Persona Software Suite supports SMB 3.0, 2.1, 2.0, and 1.0. This includes advanced SMB 3.0 protocol featureof Transparent Failover, SMB opportunistic locks (oplocks) and leases (file and directory) for all SMB versions; crediting andlarge maximum transmission unit (MTU) size for SMB 2.x and beyond versions. In addition to these SMB protocol features,File Persona Software Suite also supports Offloaded Data Transfer (ODX) features of Microsoft Windows 2012.9

Technical white paper Technical overview of HP 3PAR File Persona Software SuiteTable 2. SMB protocol version supported with various operating systemsOSWindows 8/8.1, Windows Server 2012 R2Windows 7, Windows Server 2008 R2SMB 3.0SMB 2.1SMB 2.0SMB 1.0 Windows Vista , Windows Server 2008Windows XP, Windows Server 2003 R2Mac OS 10.8, 10.9 Transparent FailoverSMB Transparent Failover is one of the key features in the feature set introduced in SMB 3.0 with Windows Server 2012and Windows 8 OSs. SMB Transparent Failover enables administrators to configure Windows File Shares to be continuouslyavailable. Using continuously available File Shares, administrators can perform hardware or software maintenance on anycluster node without interrupting the client connections that store their data files on these File Shares. Also, in case of ahardware or software failure, the clients will transparently reconnect to another cluster node without any disruption to theuser connections. To benefit from SMB Transparent Failover, both the SMB client computer and the SMB server computermust support SMB 3.0 at a minimum. Computers running down-rev SMB versions, such as 1.0, 2.0, or 2.1 can connect andaccess data on a file share that has the continuously available property set, but will not be able to leverage the benefits ofthe SMB Transparent Failover feature.SMB Oplocks and LeasesOpportunistic locks or oplocks is a client caching mechanism that allows SMB/SMB 2.0 clients to decide the client-sidebuffering strategy dynamically, so the network traffic can be minimized to improve performance. In SMB 2.1, client oplocklease model allows oplocks to be held by a client for enhanced file and handle caching opportunities for the SMB client.This feature brings performance improvement by reducing network bandwidth consumption, greater file server scalability,and better response time when accessing the files over a network. The only disadvantage of the file level oplocks or leasesis that if there are any changes in the files and folders on the file server, clients with the cached listing of that directorywould not be aware of the changes when directory listing is refreshed locally. In SMB 3.0, the directory-leasing featureimproves this behavior, by allowing the SMB client to cache the directory and file metadata together in a consistent mannerfor longer duration. Clients are notified when directory information on the server changes and the data resynchronizes andupdates the cache. This feature is designed to work with user’s home folders (read/write with no sharing) and publishedshares (read-only with sharing). This results in improved network performance and faster response time.SMB CreditingSMB 2.0 and above protocol uses a credit-based flow control, which allows the server to control a client’s behavior.The server will start with a small number of credits and automatically scale up as needed. With this, the protocol cankeep more data “in flight” and better utilize the available bandwidth. It makes it easy for clients to send a number ofoutstanding requests to a server. This allows the client to build a pipeline of requests instead of waiting for a responsebefore sending the next request. This is especially relev

Persona Software Suite. Active Directory performs name lookups and authentications for user accounts and groups and all user name lookups are stored in Active Directory name cache on the File Persona node. This cache is referenced or populated for every user name request and will be cle